CVE-2025-67648

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-67648", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-12-09T18:36:41.331Z", "datePublished": "2025-12-10T23:55:10.060Z", "dateUpdated": "2025-12-11T19:00:14.044Z"}, "containers": {"cna": {"title": "Shopware's inproper input validation can lead to Reflected XSS through Storefront Login Page", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/shopware/shopware/security/advisories/GHSA-6w82-v552-wjw2", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/shopware/shopware/security/advisories/GHSA-6w82-v552-wjw2"}, {"name": "https://github.com/shopware/shopware/commit/c9242c02c84595d9fa3e2adf6a264bc90a657b58", "tags": ["x_refsource_MISC"], "url": "https://github.com/shopware/shopware/commit/c9242c02c84595d9fa3e2adf6a264bc90a657b58"}], "affected": [{"vendor": "shopware", "product": "shopware", "versions": [{"version": ">= 6.4.6.0, < 6.6.10.10", "status": "affected"}, {"version": ">= 6.7.0.0, < 6.7.5.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-12-10T23:55:10.060Z"}, "descriptions": [{"lang": "en", "value": "Shopware is an open commerce platform. Versions 6.4.6.0 through 6.6.10.9 and 6.7.0.0 through 6.7.5.0 have a Reflected XSS vulnerability in AuthController.php. A request parameter from the login page URL is directly rendered within the Twig template of the Storefront login page without further processing or input validation. This allows direct code injection into the template via the URL parameter, waitTime, which lacks proper input validation. This issue is fixed in versions 6.6.10.10 and 6.7.5.1."}], "source": {"advisory": "GHSA-6w82-v552-wjw2", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-11T18:59:56.527334Z", "id": "CVE-2025-67648", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-11T19:00:14.044Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-67648", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-11T18:59:56.527334Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-11T19:00:09.520Z"}}], "cna": {"title": "Shopware's inproper input validation can lead to Reflected XSS through Storefront Login Page", "source": {"advisory": "GHSA-6w82-v552-wjw2", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "shopware", "product": "shopware", "versions": [{"status": "affected", "version": ">= 6.4.6.0, < 6.6.10.10"}, {"status": "affected", "version": ">= 6.7.0.0, < 6.7.5.1"}]}], "references": [{"url": "https://github.com/shopware/shopware/security/advisories/GHSA-6w82-v552-wjw2", "name": "https://github.com/shopware/shopware/security/advisories/GHSA-6w82-v552-wjw2", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/shopware/shopware/commit/c9242c02c84595d9fa3e2adf6a264bc90a657b58", "name": "https://github.com/shopware/shopware/commit/c9242c02c84595d9fa3e2adf6a264bc90a657b58", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Shopware is an open commerce platform. Versions 6.4.6.0 through 6.6.10.9 and 6.7.0.0 through 6.7.5.0 have a Reflected XSS vulnerability in AuthController.php. A request parameter from the login page URL is directly rendered within the Twig template of the Storefront login page without further processing or input validation. This allows direct code injection into the template via the URL parameter, waitTime, which lacks proper input validation. This issue is fixed in versions 6.6.10.10 and 6.7.5.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-12-10T23:55:10.060Z"}}}, "cveMetadata": {"cveId": "CVE-2025-67648", "state": "PUBLISHED", "dateUpdated": "2025-12-11T19:00:14.044Z", "dateReserved": "2025-12-09T18:36:41.331Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-12-10T23:55:10.060Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "shopware", "vendor": "shopware", "versions": [{"status": "affected", "version": ">= 6.4.6.0, < 6.6.10.10"}, {"status": "affected", "version": ">= 6.7.0.0, < 6.7.5.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:shopware:shopware:*:*:*:*:*:*:*:*", "matchCriteriaId": "F912C545-B472-43DB-8CAC-E9A5791D6E8B", "versionEndExcluding": "6.6.10.10", "versionStartIncluding": "6.4.6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:shopware:shopware:*:*:*:*:*:*:*:*", "matchCriteriaId": "5DBFD7B3-151A-46E7-81CE-30971D05FD21", "versionEndExcluding": "6.7.5.1", "versionStartIncluding": "6.7.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Shopware is an open commerce platform. Versions 6.4.6.0 through 6.6.10.9 and 6.7.0.0 through 6.7.5.0 have a Reflected XSS vulnerability in AuthController.php. A request parameter from the login page URL is directly rendered within the Twig template of the Storefront login page without further processing or input validation. This allows direct code injection into the template via the URL parameter, waitTime, which lacks proper input validation. This issue is fixed in versions 6.6.10.10 and 6.7.5.1."}, {"lang": "es", "value": "Shopware es una plataforma de comercio abierta. Las versiones 6.4.6.0 a 6.6.10.9 y 6.7.0.0 a 6.7.5.0 tienen una vulnerabilidad de XSS Reflejado en AuthController.PHP. Un par\u00e1metro de solicitud de la URL de la p\u00e1gina de inicio de sesi\u00f3n se renderiza directamente dentro de la plantilla Twig de la p\u00e1gina de inicio de sesi\u00f3n de Storefront sin procesamiento adicional o validaci\u00f3n de entrada. Esto permite la inyecci\u00f3n directa de c\u00f3digo en la plantilla a trav\u00e9s del par\u00e1metro de URL, waitTime, que carece de validaci\u00f3n de entrada adecuada. Este problema est\u00e1 solucionado en las versiones 6.6.10.10 y 6.7.5.1."}], "id": "CVE-2025-67648", "lastModified": "2026-10-14T20:10:00.190", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-67648", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-11T18:59:56.527334Z", "version": "2.0.3"}}]}, "published": "2025-12-11T00:16:23.557", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/shopware/shopware/commit/c9242c02c84595d9fa3e2adf6a264bc90a657b58"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/shopware/shopware/security/advisories/GHSA-6w82-v552-wjw2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-12-11T15:17:02.656200+00:00", "updated": "2025-12-11T15:17:02.656227+00:00", "vendors": ["shopware", "shopware$PRODUCT$shopware"]}